be sent via the server - begin to see the RFC extract quoted previously mentioned) and when that's the situation, looking at the Issuer and perhaps the AKI subject to verify which Root CA issued this primary https://ca-none.com/